⬇ Download holy card: ·
Saint cr8escape, Who Broke Out of the Container
Patron of containers, kernel parameters slipped in quietly, and shared clusters.
Life
On 15 March 2022 CrowdStrike revealed cr8escape, CVE-2022-0811 in the CRI-O container runtime. By quietly setting certain kernel parameters when creating a pod, anyone able to start a container on a Kubernetes cluster using CRI-O could escape the container and run code as root on the node. A prisoner rewriting the rules of his own cell.
Prayer
O Saint cr8escape, who climbs the container's walls, keep our runtimes from letting kernel parameters be touched. Amen.
How to celebrate
Celebrated by updating CRI-O to the fixed versions and forbidding pods from setting arbitrary sysctls.
A container that rewrites the rules changes the node's master.